v0.3.2

Changes

• Fix federated-login MFA enforcement, cross-client token introspection authorization and FAPI client-assertion policy consistency.
• Correct SD-JWT disclosure reconstruction and credential validity checks.
• Remove repeated database lookups, hashes, parsing and payload copies across token, credential, JWE, mdoc and HTTP paths. Borrow JWE header fields and share authenticated TLS certificate chains through the existing trust boundary.
• Preserve tenant isolation, atomic consumption, replay protection and certificate trust/revocation checks.

Upgrade note

Cross-client introspection requires administrator-granted security_policy.introspection_audiences. Upgrade every server instance before configuring a nonempty value. Operator protocol 3 and release-manifest schema 7 are unchanged.

Validation

All main-branch workflows passed for 385d23a330158ae78ff3fd55df2eac3a74cb2aec, including workspace quality, security and supply chain, CodeQL, coverage, operator fuzz and release policy. The tagged release pipeline includes eight native platform builds, dependency policy, OCI vulnerability scanning, signing and provenance. Tagged release pipeline: all 22 jobs passed; all 10 expected release assets are uploaded with SHA-256 digests. Ignored and conditionally skipped checks are not counted as passes.

Production deployment, official OIDF certification and complete network/kernel copy measurements are outside this release validation.

Full changelog: v0.3.1...v0.3.2